Spy app is a class of malware for mobile devices that allows an adversary to steal sensitive information. Detecting spy apps is challenging because they do not rely on classic malware techniques, for instance, they use standard services to store stolen data, and do not perform privileges escalation on the victim phone. Thus, their behavior is generally closer to the benign apps and poses new challenges for their detection. In this paper, we propose ASAINT: A Spy App Identification System based on Network Traffic. To the best of our knowledge, ASAINT is the first system capable of detecting spy apps in a network without any physical or software control of the victim mobile device. Core of our approach is a wide range of non-intrusive network detection methods designed by studying several popular spy apps. We test ASAINT on a self-collected dataset containing network traffic from both spy and benign applications, either on Android and iOS. Our result is an F1-score of 0.85 on average, that confirms the effectiveness of ASAINT. Moreover, our analysis provides a methodological classification of the exfiltration strategies used by spy apps in different operating systems. In sum, our work gives new and practical insights about the detection of modern spy apps, paving the way for future research in detecting this class of malware.@en

Recently, Unmanned Aerial Vehicles (UAVs) are employed for a plethora of civilian applications. Such flying vehicles can accomplish tasks under the pilot's eyesight within the range of a remote controller, or autonomously according to a certain pre-loaded path configuration. Different path deviation attacks can be performed by malicious users against UAVs. We classify such attacks and the relative defenses based on the UAV's flight mode, i.e., (i) First Person View (FPV), (ii) civilian Global Navigation Satellite System based (GNSS), and (iii) GNSS "plus"auxiliary technologies (GNSS+), and on the multiplicity, i.e., (i) Single UAV, and (ii) Multiple UAVs. We found that very little has been done to secure the FPV flight mode against path deviation. In GNSS mode, spoofing is the most worrisome attack. The best defense against spoofing seems to be redundancy, such as adding vision chips to single UAV or using multiple arranged UAVs. No specific attacks and defenses have been found in literature for GNSS+ or for UAVs moving in group without a pre-ordered arrangement. These aspects require further investigation. @en

Cheap commercial off-the-shelf (COTS) First-Person View (FPV) drones have become widely available for consumers in recent years. Unfortunately, they also provide low-cost attack opportunities to malicious users. Thus, effective methods to detect the presence of unknown and non-cooperating drones within a restricted area are highly demanded. Approaches based on detection of drones based on emitted video stream have been proposed, but were not yet shown to work against other similar benign traffic, such as that generated by wireless security cameras. Most importantly, these approaches were not studied in the context of detecting new unprofiled drone types. In this work, we propose a novel drone detection framework, which leverages specific patterns in video traffic transmitted by drones. The patterns consist of repetitive synchronization packets (we call pivots), which we use as features for a machine learning classifier. We show that our framework can achieve up to 99% in detection accuracy over an encrypted WiFi channel using only 170 packets originated from the drone within 820ms time period. Our framework is able to identify drone 2 transmissions even among very similar WiFi transmissions (such as video streams originated from security cameras) as well as in noisy scenarios with background traffic. Furthermore, the design of our pivot features enables the classifier to detect unprofiled drones in which the classifier has never trained on and is refined using a novel feature selection strategy that selects the features that have the discriminative power of detecting new unprofiled drones.@en

Cheap commercial off-the-shelf (COTS) drones have become widely available for consumers in recent years. Unfortunately, they also provide low-cost capabilities for attackers. Therefore, effective methods to detect the presence of non-cooperating rogue drones within a restricted area are highly required. Approaches based on detection of control traffic have been proposed but were not yet shown to work against other benign traffic, such as that generated by wireless security cameras. In this work, we propose a novel drone detection framework based on a Random Forest classification model. In essence, the framework leverages specific patterns in video traffic transmitted by drones. The patterns consist of repetitive synchronization packets (denoted as pivots) which we use as features in the proposed machine learning classifier. We show that our framework can achieve up to 99% detection accuracy over an encrypted WiFi channel using only 20 packets originated from the drone. Our system is able to identify drone transmissions even among very similar WiFi transmission (such as a security camera video stream) and in a noisy scenario with background traffic. @en